src: small audit regarding "pkg" use

Running the grep below lights up a few spots still:

    # git grep 'pkg[^/\[\.a-z'"'"',()_+"]'

Make a few decisions for the future:

* Use "pkg-static" outside the firmware code consistently
  with a full path
* Modify ambiguous code or comments to not be found by the
  grep above
* Firmware uses PKG now if we ever have to pivot to pkg-static
  or when we need to overwise modify the call.

The goal of this excerise was to find all stray package manager
spots that may run their own embedded pkg-update without the
proper environment which should be gone for now.

README.md

@@ -113,8 +113,8 @@ For php code you will need to have `phpcs` and `phpcbf` installed.
 You can use the package `php-codesniffer` on Debian/Ubuntu.
 Python code will require `pycodestyle`.
 
-For easier development you may want to use an OPNsense VM and run:
-`pkg install os-debug` that will install all the necessary tools.
+For easier development you may want to use an OPNsense VM and install
+the `os-debug` plugin that will offer the necessary tools.
 
 make sweep
 ----------

src/etc/rc.syshook.d/upgrade/10-sanity.sh

@@ -7,7 +7,7 @@ if [ -z "${CORE}" ]; then
 	exit 1
 fi
 
-if [ -z "$(pkg query %n ${CORE})" ]; then
+if [ -z "$(/usr/local/sbin/pkg-static query %n ${CORE})" ]; then
 	echo "Core package \"${CORE}\" not known to package database."
 	exit 1
 fi

src/etc/rc.syshook.d/upgrade/90-cleanup.sh

@@ -1,4 +1,4 @@
 #!/bin/sh
 
-# run a cleanup beforehand to avoid later pkg-upgrade failures
+# run a cleanup beforehand to avoid later upgrade failures
 opnsense-update -Fs

src/opnsense/scripts/firmware/check.sh

@@ -109,7 +109,7 @@ fi
 (${PKG} update -f 2>&1) | ${TEE} ${LOCKFILE} ${OUTFILE}
 
 # always update the package manager so we can see the real updates directly
-(${PKG} upgrade -r ${product_repo} -Uy pkg 2>&1) | ${TEE} ${LOCKFILE}
+(${PKG} upgrade -r ${product_repo} -Uy 'pkg' 2>&1) | ${TEE} ${LOCKFILE}
 
 # parse early errors
 if grep -q 'No address record' ${OUTFILE}; then

src/opnsense/scripts/firmware/hostnames.sh

@@ -29,7 +29,7 @@
 
 URLS=$(opnsense-update -M; opnsense-update -X)
 
-# Make a few assumptions about plugged pkg repositories:
+# Make a few assumptions about plugged package repositories:
 #
 # * grab the "url" key, delimited with double quotes
 # * remove the spurious "pkg+" prefix to treat it as raw HTTP(S)

src/www/crash_reporter.php

@@ -84,7 +84,7 @@ function upload_crash_report($files, $agent)
 
 include('head.inc');
 
-$plugins = implode(' ',  explode("\n", shell_safe('pkg info -g "os-*"')));
+$plugins = implode(' ',  explode("\n", shell_safe('/usr/local/sbin/pkg-static info -g "os-*"')));
 $product = product::getInstance();
 
 $crash_report_header = sprintf(